package net.xdclass.xdclassshiro;

import org.apache.commons.lang3.StringUtils;

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.AuthenticationInfo;

import org.apache.shiro.authc.AuthenticationToken;

import org.apache.shiro.authc.SimpleAuthenticationInfo;

import org.apache.shiro.authz.AuthorizationInfo;

import org.apache.shiro.authz.SimpleAuthorizationInfo;

import org.apache.shiro.realm.AuthorizingRealm;

import org.apache.shiro.subject.PrincipalCollection;

import java.util.HashMap;

import java.util.HashSet;

import java.util.Map;

import java.util.Set;

/**

 * 自定义realm:继承AuthorizingRealm，重写抽象方法

 */

public class CustomRealm extends AuthorizingRealm {

    private final Map<String, String> userInfoMap = new HashMap<>();

    {

        userInfoMap.put("jack", "");

        userInfoMap.put("xdclass", "");

    }

    //role->permission 模拟数据库角色与权限的关系

    private final Map<String, Set<String>> permissonMap = new HashMap<>();

    {

        Set<String> set1 = new HashSet<>();

        Set<String> set2 = new HashSet<>();

        set1.add("video:find");

        set1.add("video:buy");

        set2.add("video:add");

        set2.add("video:delete");

        permissonMap.put("jack", set1);

        permissonMap.put("xdclass", set2);

    }

    //user->role 模拟数据库角色与权限的关系

    private final Map<String, Set<String>> roleMap = new HashMap<>();

    {

        Set<String> set1 = new HashSet<>();

        Set<String> set2 = new HashSet<>();

        set1.add("role1");

        set1.add("role2");

        set2.add("root");

        roleMap.put("jack", set1);

        roleMap.put("xdclass", set2);

    }

    /**

     * 校验权限时会调用这个方法，原理就是把角色和权限封装到SimpleAuthorizationInfo的实体中，shiro框架会帮我们进行权限的校验

     * 最终org.apache.shiro.realm.AuthorizingRealm#hasRole(org.apache.shiro.subject.PrincipalCollection, java.lang.String)

     * 方法会调用这个返回的simpleAuthorizationInfo

     * @param principalCollection

     * @return simpleAuthorizationInfo

     */

    @Override

    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {

        System.out.println("权限：doGetAuthorizationInfo");

        //获取用户主账户名

        String name = (String) principalCollection.getPrimaryPrincipal();

        //通过名称查找权限，简化操作（正常是通过名称找角色，通过角色查询对应的权限）

        Set<String> permissions = getPermissonsByNameFromDB(name);

        Set<String> roles = getRolesByNameFromDB(name);

        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();

        simpleAuthorizationInfo.setRoles(roles);

        simpleAuthorizationInfo.setStringPermissions(permissions);

        return simpleAuthorizationInfo;

    }

    private Set<String> getRolesByNameFromDB(String name) {

        return roleMap.get(name);

    }

    private Set<String> getPermissonsByNameFromDB(String name) {

        return permissonMap.get(name);

    }

    //用户登录的时候会调用该方法

    @Override

    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {

        System.out.println("认证： doGetAuthenticationInfo");

        //从token中获取身份信息，token代表用户输入的信息

        String name = (String) authenticationToken.getPrincipal();

        //模拟从数据库读密码

        String pwd = getPwdByUserNameFromDB(name);

        if (StringUtils.isBlank(pwd)) {

            //这里判断是必须要加的，返回null，即为认证不通过！！！详见源码

            return null; //匹配失败

        }

        /*useNmaePasswordToken中有用户的Principal和Credential

        SimpleAuthorizationInfo代表用户的角色权限信息

        SimpleAuthenticationInfo 代表该用户的认证信息*/

        // this.getName()是获取CachingRealm的名字

        SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(name, pwd, this.getName());

        return simpleAuthenticationInfo;

    }

    private String getPwdByUserNameFromDB(String name) {

        return userInfoMap.get(name);

    }

}

package net.xdclass.xdclassshiro;

import org.apache.shiro.SecurityUtils;

import org.apache.shiro.authc.UsernamePasswordToken;

import org.apache.shiro.config.IniSecurityManagerFactory;

import org.apache.shiro.mgt.DefaultSecurityManager;

import org.apache.shiro.mgt.SecurityManager;

import org.apache.shiro.subject.Subject;

import org.apache.shiro.util.Factory;

import org.junit.Before;

import org.junit.Test;

/**

 * 自定义Realm操作

 */

public class QuicksStratTest5_4 {

    private CustomRealm customRealm = new CustomRealm();

    private DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();

    @Before

    public void inint(){

        //构建环境

        defaultSecurityManager.setRealm(customRealm);

        SecurityUtils.setSecurityManager(defaultSecurityManager);

    }

    @Test

    public void testAuthentication() {

        //获取当前操作的主体

        Subject subject = SecurityUtils.getSubject();

        //模拟用户输入账号密码

        UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken("jack", "123");

        subject.login(usernamePasswordToken);

        System.out.println("认证 结果：" + subject.isAuthenticated());

        System.out.println("getPrincipal()=" + subject.getPrincipal());

        System.out.println("调用权限校验:subject.hasRole方法会调用自定义realm重写的doGetAuthorizationInfo方法");

        System.out.println("用户jack是否有root角色:" + subject.hasRole("root"));  //false

        // 权限校验

        subject.checkRole("role1");

        System.out.println("用户jack是否有role1角色:" + subject.hasRole("role1")); //true

        System.out.println("用户jack是否有video:find权限:" + subject.isPermitted("video:find")); //true

    }

}

 protected AuthenticationInfo doAuthenticate(AuthenticationToken authenticationToken) throws AuthenticationException {

        this.assertRealmsConfigured();

        Collection<Realm> realms = this.getRealms();

        return realms.size() == 1 ? this.doSingleRealmAuthentication((Realm)realms.iterator().next(), authenticationToken) : this.doMultiRealmAuthentication(realms, authenticationToken);

    }

protected AuthenticationInfo doSingleRealmAuthentication(Realm realm, AuthenticationToken token) {

        if (!realm.supports(token)) {

            String msg = "Realm [" + realm + "] does not support authentication token [" + token + "].  Please ensure that the appropriate Realm implementation is " + "configured correctly or that the realm accepts AuthenticationTokens of this type.";

            throw new UnsupportedTokenException(msg);

        } else {
            // 这里实际上调用的就是自定义realmz中重写了的getAuthenticationInfo方法，如果返回null,抛出UnknownAccountException，认证不通过

            AuthenticationInfo info = realm.getAuthenticationInfo(token);

            if (info == null) {

                String msg = "Realm [" + realm + "] was unable to find account data for the " + "submitted AuthenticationToken [" + token + "].";

                throw new UnknownAccountException(msg);

            } else {

                return info;

            }

        }

    }